Why MCP deserves a security scan before your agent connects
Every agent framework treats tool servers as trusted plug-ins. That default made sense when everything ran on localhost; it is the wrong default on the open internet. The evidence from our own corpus: 44% of 100 public MCP servers accepted an unauthenticated handshake, and this week a live commercial x402 endpoint was silently pointed at a Sepolia testnet — protocol working exactly as designed, deployment broken underneath it.
Six checks settle whether an endpoint deserves your agent's traffic, and none of them require a security team:
- Auth posture. Does it accept an unauthenticated handshake? Does it run on a default key ("sk-1234" still works on 9.6% of exposed LiteLLM instances)? Both are five-second probes.
- Transport hardening. The Kotlin SDK's chunked-encoding DoS (CVE-2026-63658) shows transport is attack surface; check what the server accepts before your agent streams through it.
- Header hygiene. In our scans: 86% ship no CSP, 70% no nosniff, 61% no HSTS, 27% answer with ACAO:*. Cheap to test, cheap to fix, telling in aggregate.
- Tool-description integrity. Treat descriptions as attacker-controlled input — the "by design" MCP weakness means a compromised server can steer connected clients. Audit what you connect; pin versions.
- Session handling. Argo CD's CVE-2026-82456 handed sessions to anyone who could reach the server. Session takeover is the classic web bug wearing an AI costume.
- Dependency provenance. Same name, different server — silent drift is documented in the registry census. Re-verify on every bump.
Until registries ship attestation, the scan you run yourself is the only gate that matters. All six checks run in under a second per endpoint — which is why they belong in the connect path, not in a quarterly review.
Sources & further reading:
A0Flow — scan any endpoint from $0.50 · Our public MCP research